Stolen data from LiteLLM version 1.107.0 is encrypted with AES-256-CBC, wrapped with RSA-4096, and sent via HTTP POST to litellm.dev/healthcheck.

From the articleLiteLLM supply-chain attack targets credentials and installs a RAT | МежаAlso in LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor, LiteLLM supply chain attack hoovers up passwords and secrets